User Guide Getting Started Help Center Documentation Community Training
Looker
  
English
日本語
Google Authentication

Feature Overview

If desired, Looker can perform authentication via Google OAuth, for users that have accounts registered with GSuite.

A user’s Google avatar appears in the navigation bar instead of the standard user symbol:

The following behaviors might affect your decision to use Google OAuth:

Preliminary Requirements

Using Google OAuth requires the following:

Enabling Authentication with Google OAuth

Enabling authentication with Google OAuth requires an administrator to perform steps both on the Google side, and on the Looker side, as described in the following sections.

Setup on the Google Side

The steps for enabling Google OAuth on the Google side are described below. Google’s generic description of these steps is here. Further documentation on the Google Dev Console is here.

  1. Go to the Google Cloud Platform Console.

  2. Click the down arrow in the Select a project drop-down. You may see the name of an existing project in the drop-down; click the down arrow regardless, and it will take you to the option to create a new project:

  3. In the Select a project page, click New Project:

    Google displays the New Project page.

  4. Enter a specific, distinguishable name in the Project Name field:

  5. Select your organization name in the Location field.

  6. Click Create.

    When Google is done creating your new project, Google returns you to the Google Cloud Platform Console and shows your new project.

  7. In the left menu, select APIs & Services > Credentials:

  8. In the Credentials page, click the down arrow in the Create credentials button, and select OAuth client ID from the drop-down menu:

    Google displays the Create OAuth client ID page.

  9. Google requires that you configure an OAuth consent screen, which allows your users to choose how to grant access to their private data and provides a link to your organization’s terms of service and privacy policy. Click Configure consent screen. (If you have configured OAuth consent for a previous project, you will not see this option, and you can skip this and the next step.)

    Google displays the OAuth consent screen page:

    You can configure this screen for all applications in your project, including both internal and public applications. Google will perform a verification for public applications if any of these are true:

    • The application uses Google APIs that use restricted or sensitive scopes.
    • The OAuth consent screen includes an application logo.
    • The project has exceeded the domain threshold.

    When configuring the Looker side for Google OAuth, you have the option to limit access to specific domains.

    Looker requires only the default scopes, so no additional scope configuration is required.

    Looker does require an entry in the Authorized domains field. Enter the domain of the URL to your Looker instance. For example, if Looker hosts your instance at https://mycompany.looker.com, the domain is looker.com. For customer-hosted Looker deployments, enter the domain on which you host Looker.

    For information about configuring the Google OAuth consent screen, see Google’s documentation here.

  10. Configure your OAuth consent screen and click Save.

    Google returns you to Create OAuth client ID page.

  11. Under Application type, select Web application:

    Google displays the rest of the Create OAuth client ID page.

  12. In the Name field, enter a name for your OAuth client ID.

  13. In the Authorized JavaScript origins field, enter the URL to your Looker instance, including the https://. For example:

  1. In the Authorized redirect URIs field, enter the URL to your Looker instance, followed by /oauth2callback. For example: https://mycompany.looker.com/oauth2callback or https://looker.mycompany.com:9999/oauth2callback.

  2. Click Create.

    Google displays your client ID and your client secret.

  3. Copy your client ID and your client secret values — you will need them to configure Looker:

  4. Click OK.

Setup on the Looker Side

The steps for enabling Google OAuth on the Looker side are below.

  1. From the Looker application, while logged in as an administrator, click the Admin drop-down to open the Admin menu.

  2. Under the Authentication group, click Google. Looker displays the Google Authentication page:

  3. Click Enabled to display and edit Google OAuth settings. (This does not immediately enable Google authentication; you must confirm your choice later).

  4. Enter your Google Auth Settings:

  1. Enter Migration Options, which control behavior of the Looker instance during the transition to Google OAuth:

  1. Click Test Google Authentication to use the current settings and attempt to authenticate the current browser in a new window. This action does not save the current settings or apply them to the Looker instance.

    If you are not logged into Google, you are prompted to log in and asked for consent to use your Google account information. This flow uses the custom Consent screen settings you used in the Google-side setup.

    Upon success, a User Info section displays with your name, email, domain, etc. Presence of this User Info section shows that this user would be successfully authenticated by Looker.

    Upon failure, error descriptions appear. Below are some common issues:

    • Mis-copied Client ID or Client Secret. These must be carefully copied and pasted in full.
    • User is out of domain. If you see a Person Info section, but no User Info, it is probably because the user in not in the domain you specified. This shows that the person has authenticated themselves to Google correctly, but they are not using a Google account that you have chosen to allow into your Looker instance.
    • Looker URL and/or redirect URL not set up correctly in Google for your Looker.
  2. To save and apply changes, check I have confirmed the configuration above and want to enable applying it globally. Click Update.

After you enable Google authentication, users can authenticate only through Google OAuth. If you did not enable the Merge by email setting for existing accounts, every new Google-authenticated login creates a new Looker user. Existing email/password logins are not usable at the same time that Google authentication is enabled.

Tips

  1. To experiment with the full authentication cycle, you can logout of Google and see that Google prompts you to log in again when you attempt to log in to Looker.

  2. In Google you can click on Account in the personal drop-down (next to your email address on the top-right of a GSuite page) to manage your personal account.

    On that management page there is a Security tab with an Account Permissions section. Clicking on Apps and websites View all lets you (as a user) see and manage the services and apps to which you have granted permissions.

    Clicking on the Looker permissions that you granted in order to log on shows the details that users see in the consent screen that you customized above. You can also click Revoke access so that the next time you log in to Looker (or test authorization) you will be re-prompted with the consent screen. You can use this workflow to help you customize your consent screen and view what users will see.

Enabling E-mail Logins While Google Auth is Enabled

New Google accounts automatically get access to Looker, so there is no need to add users that are in your Google Domain.

To add a user via e-mail address that is not in your Google Domain:

  1. Enable the Alternate login for admins and specified users option on the Google Auth page
  2. Create or modify an existing user role to add the login_special_email permission
  3. Go to Add Users from the users panel (/admin/users/new)
  4. Add the e-mail address(es) you would like to include, and the roles those users should have, which must include a role with the login_special_email permission
  5. Those users are now able to log in via https://mycompany.looker.com/login/email (hidden URL)

Disabling Google Auth Once It Has Been Enabled

If you’d like to disable Google Authentication for your Looker instance after it has already been enabled, there are some things to think about:

This is why, currently, we suggest avoiding this route. If you must go down this path there may be a method to fix the orphaned accounts by using the Looker API. Reach out to Looker Support for additional guidance.

Top